Analyst Feedback & Active Learning Studio
Pillar 11 • HITL EngineHuman-in-the-Loop verdict override workbench, uncertainty sampling queue, concept drift tracker, and 1-Click model fine-tuning pipeline.
Total Analyst Overrides
130
94.2% agreement with Tier-3 consensus
Active Learning Queue
4 Borderline
Uncertainty threshold p in [0.45, 0.65]
Dataset Drift Index (PSI)
0.042 Stable
No significant feature distribution shift
Fine-Tuning Readiness
Ready (v4.2)
1 pending annotations
Select Target Corpus Sample
WannaCry.exe
SAMPLE-001 • Ransomware
SillyPutty.exe
SAMPLE-002 • Backdoor
SikoMode.exe
SAMPLE-003 • Stealer
RedLineStealer.exe
SAMPLE-004 • Stealer
CobaltStrike_Beacon.bin
SAMPLE-005 • C2 Beacon
Current Automated AI Inference
Model VerdictMALICIOUS
Predicted Risk Score98 / 100
Predicted FamilyRansomware
Random Forest Confidence99.4%
XGBoost Score99.8%
Dominant Feature: High .rsrc entropy + CryptEncrypt + vssadmin execution
Ground Truth Annotation & Override Panel
Overriding model decisions directly updates the active learning training dataset with high-sample weight.
Analyst ID: SOC-ANALYST-42
Click 'x' to prune incorrect mappings
T1190 - Exploit Public-Facing ApplicationT1059.003 - Command and Scripting InterpreterT1543.003 - Windows ServiceT1070.004 - File Deletion / Shadow WipeT1071.001 - Application Layer Protocol (Web)T1486 - Data Encrypted for Impact